[baby]

> When this happens as the result of malicious actions (unlike the case FB shows here), what actions can the legitimate site operator do to protect their users from this eavesdropping?

There's pretty much nothing you can do except create a new domain and try to tell users to go directly to that one.